Cloudflare

Proxy for the Cloudflare REST API (v4) through the managed gateway. Zone lookup and DNS record management. All operations are gated by PBAC policy.

Authentication

Cloudflare authenticates REST calls with an API token. This connector supports two auth modes, chosen per managed resource at install time via the Authentication field:

• Per-user API token (user_secret, default, recommended) — each user links their own scoped Cloudflare API token once, through a PolicyArc-hosted browser page reached by MCP URL elicitation on the first call. The token posts only to the AS (never through the MCP client or the model), is stored encrypted per (subject, resource), and is sent as Authorization: Bearer <token> on that user's calls — so Cloudflare attributes every action to the real user, scoped to whatever that token was granted. This is the natural fit for a shop that hasn't set up SSO: everyone already has their own Cloudflare login and can mint their own scoped token from it.
• Shared token (static) — every call uses one operator-held API token from the token_env secret. Cloudflare attributes all calls to that one identity.

Either way, PolicyArc enforces per-user authorization at the gateway via policy before the request reaches Cloudflare. See Per-user upstream credentials for how the user_secret collection flow works.

Setup

• upstream_auth.type — user_secret (default) or static.
• token_env — static mode only — a secret holding a Cloudflare API token. Hidden when user_secret is selected.

Creating a Cloudflare API token

Cloudflare dashboard → My Profile → API Tokens → Create Token, scoped to Zone:Read and DNS:Edit for the zones this connector should reach — narrower than the legacy Global API Key, which this connector does not support. In user_secret mode each user does this for themselves on the collection page; in static mode the operator provisions the shared token once.

Manifest reference

• ID: identos.cloudflare
• Version: 1.0.0
• Resource type: urn:connector:identos:cloudflare
• Capabilities: mcp

Supported auth modes

Type	Details
user_secret	—
static	scheme bearer; setup fields: token_env

Setup fields

ID	Label	Default	Secret?	Notes
upstream_auth.type	Authentication	user_secret	no	user_secret (recommended) has each user link their own scoped Cloudflare API token, so actions are attributed to the real user — the natural fit for a shop without SSO. static uses one shared token for everyone.
token_env	API token	—	yes	Used only for the static method. A secret holding a Cloudflare API token, sent as Authorization: Bearer <token>. / shown when upstream_auth.type == 'static'

Scopes

Scope
cloudflare:zones:read
cloudflare:dns:read
cloudflare:dns:write

Routes

Method	Pattern	Scope	Resource template
GET	/zones	cloudflare:zones:read	—
GET	/zones/{zone_id}	cloudflare:zones:read	cloudflare://zones/{{zone_id}}
GET	/zones/{zone_id}/dns_records	cloudflare:dns:read	cloudflare://zones/{{zone_id}}/dns_records
POST	/zones/{zone_id}/dns_records	cloudflare:dns:write	cloudflare://zones/{{zone_id}}/dns_records
PUT	/zones/{zone_id}/dns_records/{dns_record_id}	cloudflare:dns:write	cloudflare://zones/{{zone_id}}/dns_records/{{dns_record_id}}
DELETE	/zones/{zone_id}/dns_records/{dns_record_id}	cloudflare:dns:write	cloudflare://zones/{{zone_id}}/dns_records/{{dns_record_id}}

MCP tools

Name	Scope	Description
list_zones	cloudflare:zones:read	List Cloudflare zones (domains) visible to the token.
get_zone	cloudflare:zones:read	Get details for a Cloudflare zone by id.
list_dns_records	cloudflare:dns:read	List DNS records in a zone.
create_dns_record	cloudflare:dns:write	Create a DNS record in a zone.
update_dns_record	cloudflare:dns:write	Replace an existing DNS record's fields.
delete_dns_record	cloudflare:dns:write	Delete a DNS record.